Certification Accreditation – The Role of SecurityEngineering in the Systems Development Life Cycle

摘要

Security is most effective if it is planned and managed throughout an organizationsrnSystems Development Life Cycle (SDLC). Many security risks, analyses, and eventsrnoccur during a systems or applications lifetime and these issues should be dealt with fromrnthe initial planning stages and continue through all phases of the SDLC. Many systemsrntoday must also address Certification and Accreditation (C&A) before going operational.rnC&A facilitates including security as an element of the SDLC assuring that a clear set ofrnSecurity Requirements is developed and implemented, residual risk is minimized andrnclearly understood, and all security controls developed and deployed in the finalrnoperational system are documented in a System Security Plan. This paper examines thernrole of security engineering and their activities throughout the SDLC and the C&Arnprocess, the guidance that helps define the Security Requirements, and the roles of thernpeople involved to provide a basic understanding of security engineering as it applies tornC&A throughout the SDLC. One of the objectives of this paper is to help ProgramrnManager’s understand and take into account the C&A process into program plans andrnschedules.